Google caught stealing Kenyan business directory in sting operation

Photographic illustration by Aurich Lawson

Google’s “don’t be mean” motto has already come under scrutiny once this week after the company was found to be profiting from ads placed by fraudulent retailers. The search firm is again criticized, as it claims to have collected data from a Kenyan business directory, contacted businesses and told them that the directory plans to charge them a listing fee, while claiming to work in partnership with the directory operators.

Mocality Kenya operates the largest business directory in Kenya. The directory uses an innovative crowdsourcing business model to ensure that its content is comprehensive and accurate: any Kenyan with a mobile phone can submit entries to the database, and when those entries have been validated, the rewards are paid using M-Pesa, a mobile payment system. system used in a number of developing countries.

Mocality lists businesses of all sizes, and for many businesses in the directory, a listing on Mocality is their first or only web presence. The Company does not offer websites or web hosting; just a listing of business details in a directory. Mocality also operates a call center that business owners can contact if they need help updating their listings.

Mocality’s activity is its database. The data is all published on the web, and searching for companies through the website is free and unlimited, but the company guards against automated attempts to harvest the data.

In October of last year, Mocality was surprised to start receiving calls from business owners wanting help with their websites. These were initially rejected – Mocality does not offer websites – but calls continued through November and December.

This prompted the Mocality team to start doing some detective work. It analyzed its web server log files to see if there was a common link between the companies that had called for help with their websites. Indeed, there were: the directory listings of these companies had all been visited by users from a single IP address belonging to a Kenyan WiMAX ISP.

All page requests from this IP address had the same unusual web browser user agent string, indicating the use of Google Chrome on Linux. The records also showed that the pages were viewed during normal working hours, suggesting that the organization behind the mysterious IP address was using a team of humans to scour Mocality’s database. This left the company wondering what it was doing and why.

To find out, he decided to mount an undercover operation. 10% of all queries from the IP address in question would show erroneous data: instead of getting the companies’ phone numbers, the people collecting the data would get the Mocality number.

The sting only worked for three hours. Meanwhile, Mocality received seven calls. Each time the callers claimed to work for Google Kenya and that Google Kenya was working with Mocality on a project called Getting Kenyan Business Online.

Getting Kenyan business online is actually a legitimate part of Google’s effort to get business online. GKBO offers Kenyan businesses a free website and web hosting, as well as training on how to create an effective online presence. Over the past two years, the Getting Business Online initiative has connected with 400,000 businesses in 20 different countries.

But Mocality is not part of the project and has not partnered with Google to provide this data.

More troubling was that some of the calls Mocality received claimed that Mocality wanted to charge businesses Ksh20,000 (about $230) to be included in its directory, and further that GKBO charged the same amount for web hosting. None of these things were true. Mocality’s listings are all free, as is GKBO’s hosting (with one exception: companies using a custom domain name have to pay a small fee).

Although the callers identified themselves as working for Google Kenya, it could have been a simple scam. After all, as all my fellow Microsoft lottery winners know, scammers are more than willing to exploit the names of respectable companies.

But such doubts would soon be dispelled. Traffic from the Kenyan ISP stopped, to be replaced by an identical traffic pattern from, an IP address assigned directly to Google. Mocality repeated its sting operation and once again the calls started coming in, with Google staff, this time from Google India, offering website services and claiming to be partnering with Mocality.

With the evidence gathered, Mocality CEO Stefan Magdalinski went public, posting a blog post, Google, what were you thought?, detailing the company’s findings and asking the advertising giant three questions:

  1. If Google wanted to work with our data, why didn’t they just ask?
  2. Who authorized this?
  3. Who knew, and who should have known, even if they didn’t?

All good questions. Looting Mocality’s database (and violating the site’s terms of service in the process), pretending to partner with Mocality, and trying to scare companies away with directory listings with stories of monthly fees seem all right. done in contradiction to Google. Do not be evil currency.

Google says Magdalinski’s blog was the first time it learned of the problem. Nelson Mattos, Google’s vice president of product and engineering, Europe and emerging markets, released a statement saying that “We were mortified to learn that a team of people working on a Google project have used misused Mocity’s data and misrepresented our relationship with Mocity to encourage customers to create new websites. We have already fully apologized to Mocality.”

It is clear that a team working for Google on the GKBO project was harvesting data from Mocality and lying to companies. How and why this happened remains unclear. At the moment, Google still does not know who is responsible for what happened. Google Kenya has partnered with local companies under the GKBO program, and Google does not know whether it is Google Kenya or one of these partner organizations that is responsible for the misuse of Mocality data, allegations dishonest to have a partnership or allegations that Mocality wanted to charge businesses to be listed in its directory.

The attempt to collect 20,000 Ksh/month for GKBO web hosting adds another layer of intrigue; in addition to trading Mocality’s good reputation for helping recruit companies for GKBO, this suggests that someone involved in the GKBO operation is trying to pocket money for themselves by charging something that should be free.

The action of the party(ies) violated Google’s business practices, and Google asserts that it was not sanctioned. The cold calling scripts that Google thought GKBO was using make no mention of Mocality. The company promises that as soon as it has “all the facts” it will “take appropriate action with those involved”.

Listing Image by Photo Illustration by Aurich Lawson

Comments are closed.